CVE-2021-31755 is a critical stack buffer overflow vulnerability affecting Tenda AC11 routers with firmware through version 02.03.01.104_CN. This flaw allows unauthenticated attackers to execute arbitrary code on the system by sending a specially crafted POST request to the /goform/setmac endpoint. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, the vulnerability poses a severe risk, enabling full compromise of affected devices. It is actively exploited in the wild, listed in CISA's KEV catalog, and has garnered significant community attention, including the availability of Nuclei templates for detection.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 02.03.01.104_cnCPE matchmatch criteria | cpe:2.3:o:tenda:ac11_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.